DevDiff

Appearance

Network Firewall & Offline Mode ​

DevDiff is designed with an Offline-First Architecture. By default, DevDiff requires zero internet connectivity to index codebase memory, analyze AST diffs, generate changelogs, or run security scans.

When cloud-hosted AI models (OpenAI, Anthropic, Gemini) are explicitly configured, DevDiff's Network Firewall enforces strict host allowlists, zero-telemetry outbound filtering, and local proxy control.

Architecture & Outbound Flow ​

Security Capabilities ​

1. 100% Offline Mode (Default) ​

  • When paired with local Ollama models (llama3.2, codellama, deepseek-coder, qwen2.5-coder) or WebGPU, DevDiff runs 100% offline.
  • Network interfaces remain dormant; no external DNS lookups or HTTP requests are issued.

2. Strict Host Allowlist Enforcement ​

When cloud providers are enabled, the network firewall restricts outbound connections exclusively to verified AI endpoint domains:

  • api.openai.com (OpenAI API)
  • api.anthropic.com (Anthropic API)
  • generativelanguage.googleapis.com (Google Gemini API)

Any attempt to open connections to unrecognized domains or IP addresses is blocked with a security exception.

3. Zero Telemetry & Category Blocklist ​

  • Built-in Category Blocking: The firewall automatically blocks 100+ known tracking domains across 5 categories: telemetry (Mixpanel, Segment, Amplitude), analytics (Google Analytics, Tag Manager), errorTracking (Sentry, LogRocket, Rollbar), advertising (DoubleClick, LinkedIn Ads), and cdn_unknown.
  • Auditing & Control: Inspect network history via devdiff network history, watch connections in real time via devdiff network watch, and verify system disclosure with devdiff disclose.

4. Custom Enterprise Proxy Support ​

For enterprise corporate networks requiring outbound HTTP/HTTPS proxying, DevDiff respects standard proxy environment variables:

bash
export HTTP_PROXY="http://proxy.internal.company.com:8080"
export HTTPS_PROXY="http://proxy.internal.company.com:8080"
export NO_PROXY="localhost,127.0.0.1"

Configuration in .devdiff/config.json ​

json
{
  "network": {
    "offlineOnly": true,
    "allowlist": [
      "api.openai.com",
      "api.anthropic.com",
      "generativelanguage.googleapis.com"
    ],
    "strictSSL": true,
    "logOutboundRequests": true
  }
}